nihilist/tor
1
0
Fork 0
mirror of https://gitlab.torproject.org/tpo/core/tor.git synced 2024-11-11 05:33:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fixed buffer bounds check bug in tor_addr_to_str

Browse Source
This commit is contained in:
Anders Sundman 2011-11-11 07:53:58 +01:00
parent 8c7658dfdf
commit 930eed21c3
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/common/address.c
View File

@ -350,15 +350,21 @@ tor_addr_to_str(char *dest, const tor_addr_t *addr, size_t len, int decorate)
switch (tor_addr_family(addr)) { switch (tor_addr_family(addr)) {
case AF_INET: case AF_INET:
if (len<3) /* Shortest addr x.x.x.x + \0 */
if (len < 8)
return NULL; return NULL;
ptr = tor_inet_ntop(AF_INET, &addr->addr.in_addr, dest, len); ptr = tor_inet_ntop(AF_INET, &addr->addr.in_addr, dest, len);
break; break;
case AF_INET6: case AF_INET6:
/* Shortest addr [ :: ] + \0 */
if (len < (3 + (decorate ? 2 : 0)))
return NULL;
if (decorate) if (decorate)
ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest+1, len-2); ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest+1, len-2);
else else
ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest, len); ptr = tor_inet_ntop(AF_INET6, &addr->addr.in6_addr, dest, len);
if (ptr && decorate) { if (ptr && decorate) {
*dest = '['; *dest = '[';
memcpy(dest+strlen(dest), "]", 2); memcpy(dest+strlen(dest), "]", 2);